- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Norges idrettsforbund og olympiske og paralympiske komité (NIF) – €108,750 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Norges idrettsforbund faced a fine for exposing personal data of millions during a cloud service test. They used real member data without proper risk assessments, which put sensitive information at risk. This case serves as a warning for organizations to prioritize data security and conduct thorough assessments before using personal data.
What happened
Norges idrettsforbund exposed personal data of over 3 million people during a testing phase of a new cloud service.
Who was affected
Members of Norges idrettsforbund, including nearly half a million children aged 3-17, were affected by the data exposure.
What the authority found
The authority found that Norges idrettsforbund breached multiple GDPR principles by failing to conduct sufficient risk assessments and lacking proper security measures.
Why this matters
This case highlights the need for organizations to implement strong data protection measures, especially when testing new technologies. Companies should avoid using real personal data unless absolutely necessary.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Review needed — 6 March 2026.
Processing notes: articles corrected, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Following a routine sweep of Irish IP addresses, the Irish National Cyber Security Centre (CSIRT-IE) discovered the exposed personal data of millions of people. They alerted the Norwegian National Cyber Security Centre (NCSC), who then alerted NIF. The data breach followed NIF's move from an on-premise solution to Azure and was related to testing of a service (Elasticsearch) that was meant to improve member administration. NIF decided to conduct the testing on real data and, further, that it was necessary to use a significant amount of data. They also felt it was essential to conduct the testing quickly. NIF has admitted that they didn't conduct sufficient risk assessments, nor did they assess whether it was possible to use anonymized data or a narrower data selection. The personal data was exposed online in a total of 87 days. As soon as NIF was notified of the breach, they immediately corrected the mistake. It's not know if anyone has actually exploited the data breach. The personal data involved in the breach were names, gender, birth date, address, phone number, email address and club affiliation. Of the 3,2 million people affected by the breach, almost half a million were children aged 3-17 years. Did NIF uphold the principles of the GDPR, when they tested their new, cloud-based platform with real member personal data? The DPA held that NIF breached several fundamental principles as per the GDPR, as they lacked sufficient risk assessment, considerations, routines and security measures. The DPA found that the testing was conducted without sufficient risk assessments and that NIF lacked routines and security measures to properly protect the personal data, thus breaching Article 32. The DPA also emphasized that the purpose for the processing (testing new solutions for member administration) could have been achieved in a less intrusive way, e.g. by processing synthetic data - or, at least, through processing significantly less personal data. NIF should also h
Related Enforcement Actions (0)
No other enforcement actions found for Norges idrettsforbund og olympiske og paralympiske komité (NIF) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
5 May 2021
Authority
Datatilsynet (Norway)
Fine Amount
€108,750
1,250,000 NOK
About this data
Cite as: Cookie Fines. Norges idrettsforbund og olympiske og paralympiske komité (NIF) - Norway (2021). Retrieved from cookiefines.eu
Last updated: